A development team has configured a VPC peering connection (`pcx-0a1b2c3d4e5f6g7h8`) betwe… — AWS Certified SysOps Administrator - Associate

A development team has configured a VPC peering connection (`pcx-0a1b2c3d4e5f6g7h8`) between a database VPC (CIDR $172.31.0.0/16$ ) and an application VPC (CIDR $10.100.0.0/16$ ). An application server with IP address $10.100.1.45$ in Subnet App-1 is unable to connect to a PostgreSQL database instance with IP address $172.31.10.12$ in Subnet DB-1. The database security group has been configured to allow incoming traffic on port $5432$ from $10.100.1.45/32$ . The network ACLs for both subnets are configured with their default settings.

Which actions must be completed to enable successful communication between the application server and the database instance? (Select TWO.)

Add a route to the route table associated with Subnet App-1 that routes traffic for $172.31.0.0/16$ through `pcx-0a1b2c3d4e5f6g7h8`.Cevap
Add a route to the route table associated with Subnet DB-1 that routes traffic for $10.100.0.0/16$ through `pcx-0a1b2c3d4e5f6g7h8`.Cevap
C
Configure an Internet Gateway in both VPCs and add routes pointing to the Internet Gateway for the peer VPC CIDR ranges.
D
Add an outbound rule to the Network ACL of Subnet DB-1 to allow traffic to ephemeral ports ( $1024-65535$ ) for the application subnet.
E
Enable DNS resolution support for the VPC peering connection on both the requester and accepter VPCs.

Cevap

Add a route to the route table associated with Subnet App-1 that routes traffic for

172.31.0.0/16

through the peering connection, and add a route to the route table associated with Subnet DB-1 that routes traffic for

10.100.0.0/16

through the peering connection.

For communication to succeed across a VPC peering connection, bidirectional route table entries must exist. The route table for the application subnet must route database traffic (

172.31.0.0/16

) to the peering connection, and the route table for the database subnet must route return traffic (

10.100.0.0/16

) back to the peering connection. Since security groups and default Network ACLs are already configured correctly, establishing these routes will resolve the connection timeout.

Adım Adım Çözüm

Examine the network flow and routing tables of both subnets.

Confirm that traffic destined for the peered VPC needs explicit routing entries in both route tables.

VPC Peering does not automatically update subnet route tables; they must be manually updated to point to the peering connection ID.

Verify security groups and Network ACLs configuration.

The security group allows incoming port

5432

from the application server's IP address. Default Network ACLs allow all inbound and outbound traffic.

Ensures that packet filters are already open and routing is the remaining bottleneck.

Add bidirectional routes to the VPC peering connection.

Add a route in Subnet App-1's route table pointing to

172.31.0.0/16

via the peering ID, and add a route in Subnet DB-1's route table pointing to

10.100.0.0/16

via the peering ID.

This establishes a bidirectional path allowing the application server to reach the database and the database to send return packets back to the application server.

Anahtar Kavram

VPC Peering Bidirectional Routing

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular

Bu konudan daha fazla soru